Security analysis.
In our proposed framework, neither raw inputs nor the embeddings will be shared with the server or other users, which makes the model robust against poisoning and evasion attacks.
Our method, however, inherits potential privacy leakage of FL methods, where users' data might be recovered from a trained model or the gradients [1]}. It has been suggested that adding noise to gradients or using secure aggregation methods improve the privacy of FL [2]}, [3]}. Such approaches can be applied to our framework too.
